Matches the AirGate convention of putting infra credentials directly in
the deploy yaml — no Gitea Secrets configuration required, push-to-deploy
just works.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Previous commit scoped too broadly. Other env vars (TOS/SMS/WECHAT/etc.)
already have application-level fallbacks and aren't required to make the
deploy work, so they don't need to be in the workflow yet.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Previously cyberstar-env had to be created manually with kubectl, which
broke the "git push = full deploy" expectation. Workflow now derives the
runtime Secret from Gitea repo secrets each deploy, so DATABASE_URL,
AUTH_SECRET, TOS/SMS/WECHAT credentials etc. are kept in one place and
applied transactionally with the rest of the manifests.
Repo secrets that need to exist in Gitea Settings:
DATABASE_URL, REDIS_URL, AUTH_SECRET,
TOS_ENDPOINT, TOS_REGION, TOS_BUCKET, TOS_ACCESS_KEY, TOS_SECRET_KEY,
NEXT_PUBLIC_TOS_DOMAIN,
WECHAT_APP_ID, WECHAT_APP_SECRET,
SMS_ACCESS_KEY, SMS_SECRET_KEY, SMS_SIGN_NAME, SMS_TEMPLATE_CODE,
HCAPTCHA_SITE_KEY, HCAPTCHA_SECRET
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
